Privacy Notice

1. Who we are

Paidly is provided by Paidly Flow team, based in Estonia (EU). Paidly Flow team is the data controller for the personal data described in this notice — we decide why and how it is processed. Contact: support@paidlyflow.com.

Where you enter your own clients' details into Paidly, you are the controller of that data and we act as processor on your behalf.

2. Personal data we collect and why

• Account data (name, email address, login credentials, workspace and team membership): to create and secure your account and provide the Service. Legal basis: performance of a contract.
• Content you enter (client and contact details, invoices, notes, recorded messages, follow-up drafts, payments): to provide the Service. Legal basis: performance of a contract.
• Support messages you send us: to answer your questions. Legal basis: legitimate interests in supporting customers.
• Usage and technical data (log data, device identifiers, IP address, telemetry): for security, fraud prevention, troubleshooting and product improvement. Legal basis: legitimate interests.
• Email delivery data (recipient address, send and delivery status) when you send follow-ups or receive notifications: to deliver those emails. Legal basis: performance of a contract.
• Marketing communications, only where you have opted in. Legal basis: consent, which you can withdraw at any time.
• Records we must keep under accounting or tax rules. Legal basis: legal obligation.

3. Who we share data with

• Service providers and subprocessors: hosting, database, email delivery, and support tooling.
• Paddle, our Merchant of Record, for the sale of subscriptions, subscription management, payments, invoicing and tax compliance.
• Professional advisers such as legal and accounting advisers.
• Public authorities, where required by law.

We do not sell personal data.

4. International transfers

We are based in the EEA and prefer EEA hosting. Where a provider processes data outside the EEA/UK, we rely on appropriate safeguards such as an adequacy decision or the European Commission's Standard Contractual Clauses.

5. Retention

We keep account and content data for as long as your account is active. After you delete your account or workspace data, we delete or anonymise it within 30 days, except where we must retain records (for example invoices and tax records) for the period required by law.

6. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability, and objection, and the right to withdraw consent where processing relies on it. Contact support@paidlyflow.com and we will respond within one month. You may also lodge a complaint with your supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon).

7. Security

We apply appropriate technical and organisational measures, including encryption in transit, access controls, row-level data isolation per workspace, and least-privilege access for staff.

8. Cookies

Paidly uses essential cookies and local browser storage to keep you signed in and remember your preferences. These are required for the Service to work. We do not use advertising cookies. If we add analytics or marketing cookies, we will ask for your consent first and provide a way to manage your preferences.

9. Changes

We will update this notice when our processing changes and revise the date above. See also our terms and conditions.